CVE-2026-32432: 
WordPress vulnerability analysis and mitigation

CVE-2026-32432 is a Missing Authorization vulnerability in the WP Time Slots Booking Form WordPress plugin by CodePeople, classified under CWE-862. It allows unauthenticated network attackers to exploit incorrectly configured access control security levels to modify booking data. The vulnerability affects all versions of the plugin up to and including 1.2.42. It was published on March 13, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, Patchstack).

The root cause is a Missing Authorization flaw (CWE-862), where certain plugin endpoints or actions fail to verify whether the requesting user has appropriate permissions before processing the request. This falls under the broader category of Broken Access Control, where incorrectly configured security levels allow unauthenticated users to invoke privileged functionality. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity — meaning any remote attacker can trigger the vulnerable code path without preconditions. The vulnerability was reported and coordinated through Patchstack (Patchstack, Feedly).

Successful exploitation allows an unauthenticated attacker to modify booking data on affected WordPress installations, compromising data integrity. There is no direct confidentiality or availability impact per the CVSS scoring (C:N, A:N), but tampered booking records could disrupt business operations, cause scheduling conflicts, or enable fraudulent reservations. The scope is limited to the affected WordPress site's booking functionality and does not directly facilitate lateral movement or privilege escalation (Feedly).

The vulnerability has a low EPSS score of approximately 0.017%, indicating a low current probability of active exploitation in the wild. No public proof-of-concept exploit code, exploit kit integration, or threat actor attribution has been reported at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the zero-authentication requirement and network accessibility make it relatively straightforward to exploit if a PoC were to emerge (Feedly).

1. Reconnaissance: Identify WordPress sites running the WP Time Slots Booking Form plugin (version ≤ 1.2.42) using tools like WPScan, Shodan, or by inspecting plugin directories (/wp-content/plugins/wp-time-slots-booking-form/).
2. Identify unprotected endpoints: Review the plugin's registered AJAX actions or REST API endpoints that lack capability checks (e.g., check_user_logged_in, current_user_can() calls absent from handlers).
3. Craft malicious request: Send an unauthenticated HTTP POST or GET request directly to the vulnerable endpoint (e.g., wp-admin/admin-ajax.php?action=<vulnerable_action>) with crafted parameters to modify booking records.
4. Achieve unauthorized data modification: The server processes the request without verifying authorization, allowing the attacker to alter, delete, or inject booking slot data as desired (Patchstack).

• Network: Unexpected or repeated unauthenticated POST requests to wp-admin/admin-ajax.php with action parameters associated with the WP Time Slots Booking Form plugin from unknown or suspicious IP addresses.
• Logs: WordPress access logs showing requests to booking-related AJAX actions without a valid session cookie or nonce; anomalous modification timestamps on booking records.
• File System: Unexpected changes to booking data stored in the WordPress database (wp_* tables related to the plugin); no direct file system artifacts expected for this vulnerability type.
• Application: Unexplained alterations to time slot availability, booking entries, or reservation records in the plugin's admin dashboard (Feedly).

Plugin users should update the WP Time Slots Booking Form plugin to a version above 1.2.42 as soon as a patched release is made available by CodePeople. In the interim, site administrators can restrict access to wp-admin/admin-ajax.php for unauthenticated users via web application firewall (WAF) rules or by using a security plugin such as Wordfence or Patchstack to virtually patch the vulnerability. Disabling the plugin entirely until a fix is available is also a viable option for high-risk environments (Patchstack).